Luka Manojlovic

Vohljanje paketov z brezžičnimi omrežnimi karticami, ki v Windows okolju tega ne omogočajo / Sniffing packets with wi-fi network cards that do not support that in Windows environment

Večkrat sem zasledil, da se z vgrajenimi wi-fi mrežnimi karticami ne da “prisluškovati” vsemu prometu, ki ga kartica dejansko “vidi”. Moj Dell Latitude 110L ima na primer vgrajeno Intel PRO/Wireless 2200 BG kartico, ki v Windows sistemu “vohljanja paketov” ne omogoča.
Zagato se da rešiti tako, da v Windows okolju instaliramo Microsoftov generični Loopback adapter, ki se manifestira kot dodatna mrežna kartica na kateri skupaj z brezžično kartico naredimo bridge. S poljubnim programom za analizo mrežnega prometa lahko potem “vohljamo” za paketi kar preko mostičenega vmesnika. S tem načinom se izognemo instalaciji spremenjenih gonilnikov, ki imajo lahko druge slabe lastnosti – izkoristimo izključno elemente, ki so že prisotni v operacijskem sistemu. Kot primer programa za analizo paketov priporočam Wireshark / http://www.wireshark.org/
There is a problem sniffing the traffic that wireless network card can “see” using default drivers in Windows environment. My laptop’s card Intel PRO/Wireless 2200 BG adapter does not allow me to sniff wi-fi packets that are not directly sent to my adapter.
The solution is that we install Microsoft loopback adapter and then create Network bridge using Wi-Fi adapter and Loopback adapter. After reboot of the system we will be able to use prefered network analyser to “sniff” traffic on Bridge adapter which can “see” all traffic the Wi-Fi card can see.
I suggest you to try Wireshark – network analyzer: http://www.wireshark.org/

 I. del – Predstavitev problema / Part I. – The problem
(wink source) 

 II. del – Instalacija Microsoft omrežni adapter s povratno zanko / Part II. – Installing Microsoft loopback adapter 
(wink source) 

 III. del – Mrežni most / Part III. – Network bridge 
(wink source) 

 VI. del – “Vohljanje” paketov / Part IV. – Sniffin’ 
(wink source)

Windows XP VPN odjemalec / Windows XP VPN client

 Privzete nastavitve / Default settings
(wink source)

 Brez uporabe privzetega prehoda na oddaljenem omrežju / Without using default gateway on remote network
(wink source)

Uporabi privzeti prehod na oddaljenem omrežju? Da? Ne? / Using default gateway on remote network? Yes or no?
Kje je razlika? / What’s the difference?

Z uporabo prehoda na oddaljenem omrežju se vsi paketi, ki niso naslovljeni v vaše trenutno lokalno omrežje posredujejo skozi VPN in nato v npr. internet. Celoten promet v internet gre preko oddaljenega VPN strežnika. To je privzeta nastavitev, ker omogoča večjo varnost – ob enem pa je ponavadi dostop do interneta upočasnjen še posebej, če ima VPN strežnik majhno izhodno hitrost (dober primer so ADSL povezave v Sloveniji, kjer je izhodna hitrost znatno manjša od vhodne). Z izključitivjo parametra “Use default gateway on remote network” vsa promet poteka normalno, preko VPN povezave potuje samo promet, ki je dejansko namenjen v omrežje na drugi strani VPN tunela.

If you use default settings all packets that are not addressed to your current local area network are sent through VPN tunel and only after that for example in internet. This is Microsoft default settings when you configure VPN connection becouse it is more secure, but in other hand there are practical reasons for not using this parameter. Internet connection on our machine will get slower becouse it will be routed over VPN server at the other side of VPN (a good example are servers which are on ADSL connections here in Slovenia – we have fast download but slow upload speed). By removing parameter: “Use default gateway on remote network” only traffic directed to the other side of VPN tunel is router through VPN. Everything else is working normaly.

Rad bi vam predstavil mojo novo podstran ali rubriko moje strani namenjno učenju. Za lažje razumevanje in da se vam nikdar ne bo pripetilo, da si boste rekli “keko je to že šlo?” so vam v rubriki Video tutorials / Video učenje na voljo “video” posnetki računalniških posegov. / I would like to introduce you my subsite dedicated to self-learning. For better understanding and that you will never get to an issue and say “How it was done?” you can get free video tutorials.